Subject: RE: [Asrg] Re: 2. Uselessness of C/R

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Wed, 28 Jan 2004 19:00:50 -0800

> Aren't the people that use PINE and MUTT tend to be more knowledgable 
> computer users who would not be tricked by phishers?

Not really, they tend not to be folk who can't afford real software:-)

> What I meant is: isn't S/MIME with keys in DNS be the same thing as 
> DomainKeys?

No, different semantics, close but not the same.

> Why do we need accreditation? The whole point of Domain Keys 
> and similar 
> solutions, is to tie the email to the original domain, not a specific 
> accreditation authority.

The accreditation is what you would work on, the knowledge that someone has
bought a domain is not very interesting on its own.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 28 Jan 2004 22:35:11 -0500

> No, different semantics, close but not the same.

Doesn't RFC 3183 uses a domain wide key? (there is some discussion on 
the S/MIME list about using that for domain-to-domain security)

> bought a domain is not very interesting on its own.

If a specific piece of email can be traced to a specific domain, than it 
is interesting. This would force spammers to use their own domains, and 
will reduce both spoofing and phishing. In security and cybersecurity, 
it is important to narrow the playing field and with these schemes we 
can narrow them to spammer's own domains. Then other solutions can be 
applied.

Yakov

-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
  "Why are both drug addicts and computer aficionados both called 
users?" (Clifford Stoll)
-------